CVE-2026-63633

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.28.0

Description An issue exists in the freerdp dsp decode opus function within libfreerdp/codec/dsp.c where Stream EnsureRemainingCapacity is called on context->common.buffer despite opus decode writing decoded PCM (Pulse Code Modulation, a method of digitally representing analog signals) into the caller-supplied out stream. A malicious RDP server can exploit this by negotiating WAVE FORMAT OPUS with a client that has WITH OPUS enabled and WITH DSP FFMPEG disabled. This allows libopus to write a large decoded frame beyond the 4096-byte StreamPool Take destination used by channels/rdpsnd/client/rdpsnd main.c, potentially leading to client heap corruption, application crashes, or remote code execution.

Recommendations Update to version 3.28.0 or later.